From owner-svn-src-stable-10@freebsd.org Tue Jan 23 07:05:20 2018 Return-Path: Delivered-To: svn-src-stable-10@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C9393EB5C6A; Tue, 23 Jan 2018 07:05:20 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 9D2D42CA6; Tue, 23 Jan 2018 07:05:20 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E420325E3B; Tue, 23 Jan 2018 04:37:31 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w0N4bVxB040508; Tue, 23 Jan 2018 04:37:31 GMT (envelope-from kp@FreeBSD.org) Received: (from kp@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w0N4bVr1040504; Tue, 23 Jan 2018 04:37:31 GMT (envelope-from kp@FreeBSD.org) Message-Id: <201801230437.w0N4bVr1040504@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: kp set sender to kp@FreeBSD.org using -f From: Kristof Provost Date: Tue, 23 Jan 2018 04:37:31 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r328276 - in stable/10: share/man/man9 sys/kern sys/sys X-SVN-Group: stable-10 X-SVN-Commit-Author: kp X-SVN-Commit-Paths: in stable/10: share/man/man9 sys/kern sys/sys X-SVN-Commit-Revision: 328276 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable-10@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: SVN commit messages for only the 10-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jan 2018 07:05:20 -0000 Author: kp Date: Tue Jan 23 04:37:31 2018 New Revision: 328276 URL: https://svnweb.freebsd.org/changeset/base/328276 Log: MFC r327674, r327796 Introduce mallocarray() in the kernel Similar to calloc() the mallocarray() function checks for integer overflows before allocating memory. It does not zero memory, unless the M_ZERO flag is set. Additionally, move the overflow check logic out to WOULD_OVERFLOW() for consumers to have a common means of testing for overflowing allocations. WOULD_OVERFLOW() should be a secondary check -- on 64-bit platforms, just because an allocation won't overflow size_t does not mean it is a sane size to request. Callers should be imposing reasonable allocation limits far, far, below overflow. Obtained from: OpenBSD Modified: stable/10/share/man/man9/malloc.9 stable/10/sys/kern/kern_malloc.c stable/10/sys/sys/malloc.h Directory Properties: stable/10/ (props changed) Modified: stable/10/share/man/man9/malloc.9 ============================================================================== --- stable/10/share/man/man9/malloc.9 Tue Jan 23 04:30:46 2018 (r328275) +++ stable/10/share/man/man9/malloc.9 Tue Jan 23 04:37:31 2018 (r328276) @@ -29,7 +29,7 @@ .\" $NetBSD: malloc.9,v 1.3 1996/11/11 00:05:11 lukem Exp $ .\" $FreeBSD$ .\" -.Dd November 15, 2012 +.Dd January 10, 2018 .Dt MALLOC 9 .Os .Sh NAME @@ -45,6 +45,8 @@ .In sys/malloc.h .Ft void * .Fn malloc "unsigned long size" "struct malloc_type *type" "int flags" +.Ft void * +.Fn mallocarray "size_t nmemb" "size_t size" "struct malloc_type *type" "int flags" .Ft void .Fn free "void *addr" "struct malloc_type *type" .Ft void * @@ -64,6 +66,14 @@ object whose size is specified by .Fa size . .Pp The +.Fn mallocarray +function allocates uninitialized memory in kernel address space for an +array of +.Fa nmemb +entries whose size is specified by +.Fa size . +.Pp +The .Fn free function releases memory at address .Fa addr @@ -144,6 +154,7 @@ If the request cannot be immediately fulfilled, the cu to sleep to wait for resources to be released by other processes. The .Fn malloc , +.Fn mallocarray , .Fn realloc , and .Fn reallocf @@ -152,6 +163,13 @@ functions cannot return if .Dv M_WAITOK is specified. +if the multiplication of +.Fa nmemb +and +.Fa size +would cause an integer overflow, the +.Fn mallocarray +function induces a panic. .It Dv M_USE_RESERVE Indicates that the system can use its reserve of memory to satisfy the request. Modified: stable/10/sys/kern/kern_malloc.c ============================================================================== --- stable/10/sys/kern/kern_malloc.c Tue Jan 23 04:30:46 2018 (r328275) +++ stable/10/sys/kern/kern_malloc.c Tue Jan 23 04:37:31 2018 (r328276) @@ -2,6 +2,7 @@ * Copyright (c) 1987, 1991, 1993 * The Regents of the University of California. * Copyright (c) 2005-2009 Robert N. M. Watson + * Copyright (c) 2008 Otto Moerbeek (mallocarray) * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -527,6 +528,16 @@ malloc(unsigned long size, struct malloc_type *mtp, in va = redzone_setup(va, osize); #endif return ((void *) va); +} + +void * +mallocarray(size_t nmemb, size_t size, struct malloc_type *type, int flags) +{ + + if (WOULD_OVERFLOW(nmemb, size)) + panic("mallocarray: %zu * %zu overflowed", nmemb, size); + + return (malloc(size * nmemb, type, flags)); } /* Modified: stable/10/sys/sys/malloc.h ============================================================================== --- stable/10/sys/sys/malloc.h Tue Jan 23 04:30:46 2018 (r328275) +++ stable/10/sys/sys/malloc.h Tue Jan 23 04:37:31 2018 (r328276) @@ -39,6 +39,7 @@ #include #include #include +#include #define MINALLOCSIZE UMA_SMALLEST_UNIT @@ -176,6 +177,8 @@ void *contigmalloc(unsigned long size, struct malloc_t vm_paddr_t boundary) __malloc_like; void free(void *addr, struct malloc_type *type); void *malloc(unsigned long size, struct malloc_type *type, int flags) __malloc_like; +void *mallocarray(size_t nmemb, size_t size, struct malloc_type *type, + int flags) __malloc_like __result_use_check; void malloc_init(void *); int malloc_last_fail(void); void malloc_type_allocated(struct malloc_type *type, unsigned long size); @@ -188,6 +191,20 @@ void *reallocf(void *addr, unsigned long size, struct int flags); struct malloc_type *malloc_desc2type(const char *desc); + +/* + * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX + * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW + */ +#define MUL_NO_OVERFLOW (1UL << (sizeof(size_t) * 8 / 2)) +static inline bool +WOULD_OVERFLOW(size_t nmemb, size_t size) +{ + + return ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) && + nmemb > 0 && __SIZE_T_MAX / nmemb < size); +} +#undef MUL_NO_OVERFLOW #endif /* _KERNEL */ #endif /* !_SYS_MALLOC_H_ */